DF-X1FORENSIC CONSOLE

IN PLAIN ENGLISH

What DF-X1
actually does.

A USB drive, external hard drive, or SD card can carry malware without looking any different from one that doesn’t. Portable media can move threats between computers, within your organization and beyond. You can’t tell what’s on a drive just by looking at it.

DF-X1 gives you a simple first step: plug the media into DF-X1 before you connect it to your computer. The standalone console screens the media for threats without needing a host PC. Follow the lights on the device, then use the companion app to review the findings and keep a chain-of-custody record.

A green light means no threat was detected within the completed scan’s scope. A red light means a threat was detected—keep the media disconnected from your computer and review the finding. If a scan is incomplete or inconclusive, check the reason before deciding what to do next.

Screen the media.
Before the next connection.

COMPLEMENTARY DETECTION METHODS

More than a malware lookup.
A layered examination of your media.

DF-X1 combines multiple detection methods to examine portable media before its next connection. It checks for known malware, applies threat-detection rules, and looks for suspicious files, concealed content, and techniques used to spread infections through USB drives—all while screening read-only.

01

SIGNATURE-BASED DETECTION

Recognize known threats.

Compare file content against current malware signatures to identify recognized viruses, ransomware, and other malicious software.

02

RULE-BASED DETECTION

Look for malicious patterns.

Apply detection rules that examine combinations of content and code patterns associated with threats—not simply a filename or extension.

03

STRUCTURAL & HEURISTIC CHECKS

Spot the techniques.

Examine suspicious shortcuts, autorun instructions, disguised executables, and encoded scripts—the mechanisms attackers use to hide or launch malicious content.

04

MEDIA & CONCEALED-CONTENT CHECKS

Look beyond the visible file list.

Inspect supported alternate data streams and selected boot and partition regions for concealed content and suspicious structures.

A changed filename can hide what a file is.
It doesn’t change what DF-X1 examines.

FROM INSERTION TO A DOCUMENTED RESULT

Connect. Protect.
Examine. Report.

  1. 01

    Connect.

    Insert supported portable media into DF-X1. The standalone console handles the screening—no host PC required.

    PORTABLE MEDIA → DF-X1
  2. 02

    Protect.

    Mount supported volumes read-only and establish the initial content hash. Examine the files without changing, deleting, or adding content to the drive.

    READ-ONLY ACCESS + INITIAL HASH
  3. 03

    Examine.

    Run the applicable detection layers while the console remains network-isolated. The LED matrix shows progress; the companion app provides the detail.

    SIGNATURES + RULES + STRUCTURAL CHECKS
  4. 04

    Report.

    Combine the findings, check the before-and-after content hashes, and record the result in the tamper-evident chain-of-custody log.

    FINDINGS + INTEGRITY + RECORD